An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. django.middleware.cache.UpdateCacheMiddleware erroneously caches requests where the Vary header contained an asterisk (''). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.
Announce: https://www.djangoproject.com/weblog/2026/apr/07/security-releases/
CVE JSON Record for CVE-2026-33033: https://www.cve.org/CVERecord?id=CVE-2026-33033
CVE JSON Record for CVE-2026-33034: https://www.cve.org/CVERecord?id=CVE-2026-33034
CVE JSON Record for CVE-2026-3902: https://www.cve.org/CVERecord?id=CVE-2026-3902
CVE JSON Record for CVE-2026-4277: https://www.cve.org/CVERecord?id=CVE-2026-4277
CVE JSON Record for CVE-2026-4292: https://www.cve.org/CVERecord?id=CVE-2026-4292
In accordance with our security release policy <https://docs.djangoproject.com/en/dev/internals/security/>, the Django team is issuing releases for Django 6.0.4 <https://docs.djangoproject.com/en/dev/releases/6.0.4/>, Django 5.2.13 <https://docs.djangoproject.com/en/dev/releases/5.2.13/>, and Django 4.2.30 <https://docs.djangoproject.com/en/dev/releases/4.2.30/>. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.
Django 4.2 has reached the end of extended support ================================================== Note that with this release, Django 4.2 has reached the end of extended support. All Django 4.2 users are encouraged to upgrade <https://docs.djangoproject.com/en/dev/howto/upgrade-version/> to Django 5.2 or later to continue receiving fixes for security issues.
See the downloads page <https://www.djangoproject.com/download/#supported-versions> for a table of supported versions and the future release schedule.
CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ====================================================================
ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, such a header could be spoofed by supplying a header named with underscores.
Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched in CVE-2015-0219.) But under ASGI, there is not the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscoresinheaders off;).
Headers containing underscores are now ignored by ASGIRequest, matching the behavior of Daphne, the reference server for ASGI.
This issue has severity "low" according to the Django Security Policy.
Thanks to Tarek Nakkouch for the report.
CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin =============================================================
Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin.
This issue has severity "low" according to the Django Security Policy.
Thanks to N05ec@LZU-DSLab for the report.
CVE-2026-4292: Privilege abuse in ModelAdmin.listeditable ==============================================================
Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data.
This issue has severity "low" according to the Django Security Policy.
CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload ===============================================================================================================
When using django.http.multipartparser.MultiPartParser, multipart uploads with Content-Transfer-Encoding: base64 that include excessive whitespace may trigger repeated memory copying, potentially degrading performance.
This issue has severity "moderate" according to the Django Security Policy.
Thanks to Seokchan Yoon for the report.
CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass =========================================================================================================
ASGI requests with a missing or understated Content-Length header could bypass the DATAUPLOADMAXMEMORYSIZE limit when reading HttpRequest.body, potentially loading an unbounded request body into memory and causing service degradation.
This issue has severity "low" according to the Django Security Policy.
Thanks to Superior for the report.
Affected supported versions ===========================
Django main Django 6.0 Django 5.2 Django 4.2
Resolution ==========
Patches to resolve the issue have been applied to Django's main, 6.0, 5.2, and 4.2 branches. The patches may be obtained from the following changesets.
CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation --------------------------------------------------------------------
On the main branch <https://github.com/django/django/commit/caf90a971f09323775ed0cacf94eadaf39d040e0> On the 6.0 branch <https://github.com/django/django/commit/a623c3982857e80324448f85c7faf9a6710330ef> On the 5.2 branch <https://github.com/django/django/commit/1cc2a7612f97c109b92415fc11ba9bd0501852e0> On the 4.2 branch <https://github.com/django/django/commit/4412731aa64d62a6dd7edae79e0c15b72666d7ca>
CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin -------------------------------------------------------------
On the main branch <https://github.com/django/django/commit/ef8b25dcc06d158683a5623ce406d561638f4073> On the 6.0 branch <https://github.com/django/django/commit/08a752c1cd8f378b4c64d96c319da23726df6ed3> On the 5.2 branch <https://github.com/django/django/commit/60ffa957c427e10a2eb0fc80d1674a8a8ccc30b0> On the 4.2 branch <https://github.com/django/django/commit/051f3909e820360bbe84a21350e82f4961e3d917>
CVE-2026-4292: Privilege abuse in ModelAdmin.listeditable --------------------------------------------------------------
On the main branch <https://github.com/django/django/commit/6afe7ce93964f56e33a29d477c269436f9b60cbf> On the 6.0 branch <https://github.com/django/django/commit/428c48f358c5a0ed5ca2834fb721d615eb2b0e11> On the 5.2 branch <https://github.com/django/django/commit/397c22048244db2cd4bb78f570e6c72a3967bf36> On the 4.2 branch <https://github.com/django/django/commit/abfe1a1c57a57cfaf6dd4a0571c029401a0fe743>
CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload ---------------------------------------------------------------------------------------------------------------
On the main branch <https://github.com/django/django/commit/7e9885f99cee771b51692fadc5592bdbf19641aa> On the 6.0 branch <https://github.com/django/django/commit/0910af60468216c856dfbcac1177372c225deb76> On the 5.2 branch <https://github.com/django/django/commit/0b467893bdde69a2d23034338e76021a1e4f4322> On the 4.2 branch <https://github.com/django/django/commit/f13c20f81b56108ac477213fa5ada2524b5e5c98>
CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass ---------------------------------------------------------------------------------------------------------
On the main branch <https://github.com/django/django/commit/953c238058c0ce387a1a41cb491bfc1875d73ad0> On the 6.0 branch <https://github.com/django/django/commit/393dbc53e848876fdba92fbf02e10ee6a6eace6b> On the 5.2 branch <https://github.com/django/django/commit/49e1e2b548999a35a025f9682598946bda9e9921> On the 4.2 branch <https://github.com/django/django/commit/ed4dfda62718a0bb644b80ac8b1d3099861f2295>
The following releases have been issued =======================================
Django 6.0.4 (download Django 6.0.4 <https://www.djangoproject.com/download/6.0.4/tarball/> | 6.0.4 checksums <https://www.djangoproject.com/download/6.0.4/checksum/>) Django 5.2.13 (download Django 5.2.13 <https://www.djangoproject.com/download/5.2.13/tarball/> | 5.2.13 checksums <https://www.djangoproject.com/download/5.2.13/checksum/>) Django 4.2.30 (download Django 4.2.30 <https://www.djangoproject.com/download/4.2.30/tarball/> | 4.2.30 checksums <https://www.djangoproject.com/download/4.2.30/checksum/>)
The PGP key ID used for this release is Jacob Walls: 131403F4D16D8DC7 <https://github.com/jacobtylerwalls.gpg>
General notes regarding security reporting ==========================================
As always, we ask that potential security issues be reported via private email to security () djangoproject com, and not via Django's Trac instance, nor via the Django Forum. Please see our security policies <https://www.djangoproject.com/security/> for further information.